Planning Application Security Audits Based on ISO/IEC 27034
This domain tests how to turn 27034 concepts into an audit plan: scope, criteria, sampling, evidence requests and team resourcing.
Scope and criteria
Define scope by the ONF's applicability and the ASLC stages in play, then list applications, business units, suppliers and environments. Audit criteria normally include the ONF (Part 2), the application security management process (Part 3), validation records (Part 4) and ASC definitions (Part 5). Where the organization has mapped its ONF to ISO/IEC 27001 or 27002, those mappings are context, not a substitute for the ONF.
Risk-based sampling
Sample by application security risk, data sensitivity, criticality, change rate and third-party dependency. Include all high-risk applications where feasible, plus a random lower-risk sample to test consistency. For each selected application, plan to trace risk assessment → ASC selection → implementation evidence → validation evidence.
Worked example
An audit covers 60 applications; 12 are in scope. The plan selects all five high-risk applications, four medium-risk and one low-risk at random. For each, the auditor will test ASC selection, design and build evidence, test and production configuration, and validation records. Criteria are the ONF clause and each ASC's verification guidance. The reasoning: high-risk concentration gets full coverage; the random low-risk case tests whether the ONF is applied consistently rather than only to visible projects.
Traps
- Auditing documents only, with no implementation evidence.
- Using a generic 27002 checklist when the ONF defines specific ASCs.
- Sampling by convenience - only the applications with cooperative teams.
- Omitting supplier-hosted or cloud applications from scope.
- Planning technical tests the team is not competent to perform.